CVE-2024-41149
Published: 11 January 2025
Summary
CVE-2024-41149 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-41149 is a use-after-free vulnerability in the Linux kernel's block subsystem. It occurs when an 'hctx' (hardware context) is reused without first being removed from the cpuhp callback list, potentially triggering a use-after-free condition. The issue is classified under CWE-416 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could allow the attacker to trigger the use-after-free, potentially leading to arbitrary code execution, data corruption, or system denial of service within the kernel's unchanged security scope.
Mitigation involves applying the relevant stable kernel patches, as detailed in the upstream commit references: 85672ca9ceeaa1dcf2777a7048af5f4aee3fd02b, b5792c162dcf6197bf3d2de2be6c8169435b73d0, and ee18012c80155f6809522804099621070c69ec72. These commits explicitly address the issue by preventing reuse of 'hctx' instances not removed from the cpuhp callback list.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38918
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: block: avoid to reuse `hctx` not removed from cpuhp callback list If the 'hctx' isn't removed from cpuhp callback list, we can't reuse it, otherwise use-after-free may be triggered.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF directly enables privilege escalation via arbitrary code execution in block subsystem.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of flaws such as the use-after-free in the Linux kernel block subsystem via patching.
Requires vulnerability scanning to identify unpatched kernel instances affected by CVE-2024-41149 and subsequent remediation to prevent exploitation.
Implements memory protection mechanisms that mitigate exploitation of use-after-free vulnerabilities like improper hctx reuse in the kernel.